Increasing connectivity: Using operator event sequence diagrams to assess the integration of new technology within the flight deck

Growing interest in “connected services” is set to revolutionize the design of future transport systems. In aviation, connected portable Electronic Flight Bags (EFBs) would enable some of the traditional and more arduous preflight activities (e.g., route planning) to be conducted away from the flight deck. While this offers the opportunity to improve efficiency, any potential changes to the performance of the system need to be considered alongside the possible negative outcomes. The impact of EFBs on flight operations is assessed using Operator Event Sequence Diagrams (OESDs), which allow the operator interactions with technological systems to be mapped across different scenarios. This paper presents two OESDs: one focusing on current practise and one representing a “future” scenario whereby connected EFBs are commonplace. Our analysis predicts a 44% reduction in flight‐crew operational loading due to increased connectivity in the flight deck. Not only does the analysis highlight the reduction in operations but it also presents the utility of OESDs in the development of the connected EFBs of the future as well as their broader use in understanding the impact of new technologies on performance.

Single European Sky ARM Research and NextGen programs is likely to drive significant transformations to the traditional Flight Management System (FMS) (van Wagenen, 2015).
FMSs are one of the most sophisticated technologies onboard modern-day aircraft (Avery, 2011).The FMS determines the position of the aircraft and aids in adherence to a flight plan.The main input modality into the FMS is via a Control Display Unit (CDU) (Singer & Dekker, 2001).Whilst the design of the CDU is typical to all manufacturers (i.e., it includes a screen, line select keys, alphanumeric keys, function keys, and warning lights, for example, see Mentour Pilot, 2015), there are some differences with regard to the position of letter keys and use of function keys across manufacturers.This brings with it the risk of "negative transfer" when pilots transition between systems (e.g., more likely to press the wrong button-Singer & Dekker, 2001;Stanton et al., 2009).Further, the CDU has multiple layers which creates a "keyhole effect" (Woods & Watts, 1997) whereby users can get lost within the system, as they can only see a small portion of relevant information at any time.Thus, pilots must memorize functions and their respective locations within the menu structure (Marrenbach et al., 1998).
The FMS is often criticized for being too complex and vulnerable to human error (Courteney, 1998;International Air Transport Association, 2015).In 1992, Eldredge et al. reported that the most likely errors involving the FMS centered on flight-crew misinterpretation of data, keyboard errors, and mode control panel selection errors.Given that the design of the FMS has remained unchanged for decades it seems likely that the same errors continue to occur (International Air Transport Association, 2015).It is also likely they will continue to impact operational efficiencies through unnecessary time spent navigating complicated interfaces, or correcting misentered information; with the potential for safety concerns if errors are not identified in the second-pilot's check.
Therefore, more needs to be done to improve the interaction between the flight crew and the FMS, especially given that it is integrated into virtually every flight function, including navigation, performance, guidance, display management, and data management (Billings, 1997).
Next-generation FMS software is likely to take advantage of increased connectivity.In August 2018, Boeing released some initial findings relating to their new "RouteSync" service currently under development (Boeing, 2018)."RouteSync" enables the automatic uplink of flight plans, weather information, and other performance data directly into the FMS.Boeing (2018) claims that "RouteSync" saved between 200 and 335 h during a 6-week test period as the requirement for pilots to perform manual data entry tasks is reduced considerably.Similarly, GE Aviation (2018) introduced the concept of a "Connected FMS" (CFMS) which provides a platform in which tablet applications can interface directly with the aircraft FMS.One specific capability of the CFMS is to automatically update flight plans to the FMS, again removing the requirement for pilots to manually input data.These technological innovations suggest that a pilot's interaction with the FMS is therefore set to change as increasing levels of automation are introduced into the system.However, it is unclear how the new interface between the pilot and the CFMS will appear and behave.
Lorenzo-del-Castillo and Couture (2016) speculate future cockpit design to utilize more interactive, tactile inputs (i.e., incorporating tactile surfaces, gesture interaction, voice recognition, and position detection).This is consistent with the way in which we interact with a whole host of everyday products, including smartphones, home appliances, and ticket-selling points (that have moved away from physical control inputs to touch-enabled surfaces).With this in mind, it seems reasonable to assume touchscreen technology will become a more prominent feature within the flight deck.There has already been a vast amount of research conducted that assesses its utility within the flight deck environment (e.g., Coutts et al., 2019;Dodd et al., 2014;Harris, 2011;Stanton et al., 2013).
Nowadays, the majority of airline pilots use an Electronic Flight Bag (EFB).Portable EFBs come in multiple forms (i.e., smartphone, tablet, and laptop) and are used by pilots to perform a variety of functions that have previously relied upon paper-based documents (Johnstone, 2013;Winter et al., 2018).Currently we see great variability in the level of information integration, with more advanced EFBs able to display an aircraft's position on navigational charts, show real-time weather information, and be used to perform complex flight-planning tasks.Conventionally, some EFBs (referred to as installed EFBs) are built into the aircraft's architecture.However, it may be possible that, in the future, some preflight tasks relating to route planning could be conducted away from the aircraft (e.g., services provided by RocketRoute, 2018).Skaves (2011) identified additional functionality for portable EFB including, but not limited to, uploading flight-planning information directly into the aircraft FMS.
Currently EFB can be used in the aircraft cockpit but they are not recognized as certified equipment of the aircraft (Turiak et al., 2014).Skaves (2011) has argued, however, that operators have sought additional EFB capability for some time as well as expressing a desire to also expand the scope of operational use.Connected EFB therefore offers a pertinent avenue in which the operational capabilities of EFB can be extended and accepted by end users (i.e., pilots).

| COMPARING THE " PRESENT" WITH THE " FUTURE" METHOD OF INTERACTING WITH THE FMS
To explore how changes to pilot-FMS interaction will impact wider system dynamism, the representational medium of Operator Event Sequence Diagrams (OESDs; Brooks, 1960;Kurke, 1961) has been used.We pay particular attention to the functional loading of system agents to determine the potential impact of this new interaction.
Using OESDs users progress through the various stages of performing an action within a specific scenario identifying actors and the tasks (operations) that each must successfully complete in order for the overall sequence to occur.OESDs are proposed as they provide a rigorous basis in which the allocation of system function can be assessed through means of a workflow (Harris et al., 2015).These workflows present a time-based sequence of tasks that must be completed, as well as the interaction between humans and technological artefacts (Stanton et al., 2013).They can be used to facilitate comparisons between different human/machine configurations (i.e., identify tasks and functions that are no longer required as well as identifying new automation requirements; Harris et al., 2015).
OESDs are widely used within the Systems Engineering approach to explore the relationships between individual subsystem components (Banks & Stanton, 2017).OESDs originate from the weapons industry whereby explicit human-machine interaction needed to be defined (Brooks, 1960).They have since been applied to a wide range of domains, including air traffic control (Walker et al., 2005), rail (Walker et al., 2006), flight decks (Harris et al., 2015;Huddlestone et al., 2017;Sorensen et al., 2011), the nuclear industry (Kirwan & Ainsworth, 1992), and automated driving (Banks et al., 2014;Banks & Stanton, 2017).
In terms of the flight deck, Harris et al. (2015) utilized OESD representations to investigate the differences between single-pilot and dual-pilot cockpits.They used OESDs to determine which tasks/functions could be automated in a new single-pilot configuration and which tasks/functions may become redundant.Sorensen et al. (2011) in contrast used OESDs to graphically represent distributed cognition in the cockpit for the process of descent and approach for landing.This was based on Hutchins (1995) article which has been influential in the advance of the systems ergonomics perspective, including in relation to the development of the distributed situation awareness model (Stanton et al., 2006).
OESDs were also highlighted by Eldredge et al. (1992) as an appropriate methodology to use in the assessment of FMS procedures as they can culminate in the development of recommendations for the redesign of standardized interfaces, procedures, and location of critical information.A comparison between the "present" system of data entry (i.e., manual data entry) and a "future" system of data entry (i.e., via a connected portable EFB) is provided.This enables us to explore how changes to the system initialization process may impact operations of the future using the representational medium of OESDs.

| Method and procedure
OESDs were first developed as a means of conceptualizing complex, multiperson, and decision-making sequences.Since their development, OESDs have been applied to a variety of different domains; notably Harris et al.'s (2015) application to commercial flight deck activities.While there are many other human factors methods that can be used to model a system, the advantage of OESDs is the opportunity they provide to consider how subsystems interact and impact one another.In plotting the specific scenario, OESDs utilize standardized geometric shapes to convey meaning.These geometric shapes are presented in Table 1.To make sense of the OESD within this paper, readers are encouraged to familiarize themselves with the meaning of these symbols (for further information see Stanton et al., 2013).
The scenario in which OESD representations were developed focuses solely on FMS system initialization (i.e., preflight route planning activities).Two OESD representations have been developed using a team of four Human Factors practitioners with over 60 years of combined experience in the application of Human Factors methods.All practitioners have worked extensively in the field of Aviation Human Factors.These representations were then reviewed by a commercial airline pilot with 10 years of flight experience and over 5000 recorded flight hours on Boeing 757, 767, and 787 aircraft.The pilot was brought onboard as a subject matter expert and provided substantial input to the Human Factors practitioners to aid in the development of the OESDs.The pilot was able to shed light on the more detailed steps taken in the current preflight-planning activities, particularly advising which were crucial steps that should not be altered, and which could potentially be condensed to reduce potential error.As the pilot is familiar with the Boeing 757, 767, and 787 aircraft, it is these systems that the "present" OESDs were based upon.The use of a subject matter expert to confirm the procedures and processes is a common practice in Human Factors research (e.g., McLean et al., 2019;Parnell et al., 2021).
Online video tutorials surrounding the use of FMS and commercial videos for future systems were also used to inspire OESD development through online forums, such as YouTube (e.g., Boeing, 2018;GE Aviation, 2018;Mentour Pilot, 2015, 2017).The first step in constructing the OESD was to identify all possible system agents that are involved during the system initialization process.
These are presented in Table 2. Once agreement had been reached on these actors, the process of developing an OESD for the "present" system began in an iterative manner.The process was largely led by the commercial pilot, who would explain the processes taken to complete a manual data entry while completing the OESD.Drawing on the pilot's knowledge of the preflight process, the Human Factors experts were able to classify the process of data entry and develop the OESD.Whilst the authors acknowledge that the predominant method of data entry in recent years is via a predetermined company route, we focused on manual data entry as it is recognized that

| RESULTS
An excerpt of the OESD for manual data entry is presented in Figure 1 (for complete OESD, please see Supporting Information).
The OESD identifies the tasks and operations that are carried out by each corresponding agent and demonstrates how these may be linked, or interact, with other agents within the system network.It is important to note that this OESD should be viewed as a prototypical representation of how a pilot may operate the system as we recognize that there are a number of ways in which system initialization can be achieved (i.e., there is no standardized way of interacting with the FMS).It is therefore important to acknowledge that minor deviation from this pathway of interaction may occur (although this only relates to the order in which data are entered, not the processes involved).Overall, this OESD suggests that there are a minimum of 142 operations that must be completed to satisfy the system initialization process.
In contrast, the "future" system of system initialization using a connected, portable EFB device, proposes that a minimum of 84 operations are required to satisfy the system initialization process.
This suggests a significant reduction in task requirements with the introduction of new technology.Rather than manually inputting data into the system, Pilot 1 simply needs to cross-check the data available on screen once the synchronization process has been completed (i.e., in other words, perform a consistency check).Once Pilot 2 has entered the flight deck and completed the initial pairing activity, they would need to complete a "silent" check between the preloaded FMS and Portable EFB 2 to ensure consistency before confirming system initialization with Pilot 1.
It is also worth noting that before embarking on the aircraft, both pilots would need to check that both of their portable EFB devices are presenting the same information.This process ensures consistency between EFB 1 and EFB 2, and between EFB 1 and the FMS, and finally consistency between the FMS and EFB 2 which provides a more robust strategy than current operational practise.Thus, the portable EFB could become like the FMS for automation, the heart of all route planning activities on the open flight deck.An excerpt of the OESD is provided in Figure 2 (for complete OESD, please see Supporting Information).
However, to further emphasize the differences between "present" and "future" systems, operational loading scores were calculated.
Operational loading scores simply provide a count of all operations within the task (e.g., process, decision, manual input, etc.) (Stanton et al., 2013).Table 3 presents the total number of operations in both "present" and "future" systems.This predicts a 44% reduction in total operations in the "future" system.The greatest differences appear to be related to pilot task loading (i.e., reduction in manual inputs, increased decisions).Hence, when we consider only the operational loadings associated with the flight crew (see Table 4), we can see that the number of tasks associated with Pilot 1 is significantly reduced when using a Connected EFB by approximately 63%.
There are however a greater number of decisions required by Pilot 1 as they conduct "review"-based activities associated with a connected EFB, namely, associated with ensuring consistency between devices.Instead of inputting data in the "future" system, Pilot 1 must now make multiple decisions throughout the process to determine whether or not the information automatically loaded into the FMS is consistent with the data presented on EFB 1.This increases the potential for new types of error to emerge.Rather than action-based errors associated with inputting data (Marrenbach, F I G U R E 2 Excerpt from OESD modelling the "future" system of data entry using projected task flows.OESD, Operator Event Sequence Diagram.
BANKS ET AL.
| 57 et al., 1998), there is greater potential for checking-based errors associated with comparing two display screens.This checking task may place more burden on the pilot, increasing their workload and leaving them vulnerable to failure.Until the FMS is able to identify erroneous input (and subsequent output), the onus of responsibility remains firmly on the shoulders of the pilots (International Air Transport Association, 2015).
Going forward, we may want to evaluate alternative functional allocations (e.g., designing software capable of "flagging" inconsistencies between displays) to reduce the likelihood of checking-based errors.Notably, Pilot 2 sees a slight increase in task loading due to the requirements surrounding the linkage between EFB and FMS.
This is unlikely to pose a significant cognitive burden, especially when we consider the context in which the work must be completed (i.e., preflight setup).

| DISCUSSION
The OESDs presented in this paper predict how new flight deck technology may change the nature of FMS system initialization from a manual data entry task to more of a checking and reviewing task.
Furthermore, the analysis predicts a 44% total reduction in operations performed in a "future" system, with a 63% reduction in Pilot 1 task loading as there is no longer a requirement for Pilot 1 to manually input route planning data into the FMS.Whilst this may be viewed with positivity, Harris et al. (2015) remind us that OESDs are unable to quantify the cognitive loading of operations.More research is needed to determine the impact of task load reduction (i.e., the number of tasks required to be performed) on the cognitive workload of the flight crew.
However, the OESD approach does provide insight into how the allocation of tasks may change as a result of introducing new technology into the flight deck and in addition, identify how this may change the type of tasks required (i.e., manual data entry to more checking, monitoring tasks).Checking and reviewing tasks (typically performed by Pilot 2) in particular seem a prime candidate for automation support, especially if there is a move towards single-crew operation.For instance, Harris et al. (2015) suggested automation could be used to cross-check pilot actions against predetermined checklist requirements.This may also be applicable to preflight tasks involving connected technologies.
Even so, it is important that future research seeks to validate the processes identified within these models with more pilots with a range of experiences.It is hoped however that the OESD representations presented in this paper may be used to assist in the development of design and user requirements for future systems.

| Considerations of using connected EFBs
Whilst data communication is becoming more efficient, Speyer (1989) cautions that the integration of new technology into the Comparison of total number of operations between "present" and "future" systems.flight deck needs to be carefully considered.One of the greatest concerns surrounding the use of connected portable EFB devices, for example, is cybersecurity (Biesecker, 2017;European Aviation Safety Agency, 2017;International Civil Aviation Organization, 2012, 2016;Sampigethaya & Poovendran, 2013).A cyber-attack would intentionally seek "to alter, disrupt, deceive, degrade, or destroy adversary computer systems or networks or the information and (or) programs resident in or transmitting these systems or networks" (Owens et al., 2009, p. S-1).Thus, a compromised system has the potential to impact safety but also impact the efficiency and reputation of the system (Seawright, 2018).A pilot's reaction to a cyber-attack is also important to consider (Nguyen et al., 2017).A successful cyberattack can create high levels of uncertainty as pilots will not know whether the data presented to them can be trusted (if they have the knowledge that they are under attack at all; Dutt et al., 2013;Gontar et al., 2018).Within the design of this technology it is therefore important to review the infrastructure and how it can help recognize, respond to, and alert pilots to, potential breaches in security (Gontar et al., 2018).
Further, we must also not overlook that allocating a function or task to another actor within the system will create new functions for existing actors (i.e., new monitoring and checking activities for flight crews: Dekker & Woods, 2002).Complacency and overreliance become a real threat to system safety especially when we consider Kern's (1998, p. 240) claims that "as pilots perform duties as system monitors, they will be lulled into complacency."Connected technology, in the context of a pilot's cockpit, could unwittingly undo existing safety measures (i.e., changes to current checking/crosschecking procedures would need to be reviewed).Furthermore, there are also concerns relating to skill degradation (e.g., Bainbridge, 1983;Casner et al., 2014).The rise of automated datalink within the systems initialization process in commercial aviation means that pilots in general, are no longer required to manually input all aspects of route planning.Nevertheless, it is still imperative to consider the manual task of data entry because in the event of technological failure, or inability to maintain contact with ground support, pilots may be required to revert back to the traditional means of data entry (i.e., those used in the "present system"; Winter et al., 2018).
Whilst within this analysis, we have opted to concentrate on the FMS, in reality there are many other tasks to be conducted in the preflight stage, including external checks to the aircraft that both pilots must carry out.While a proposed solution may be to divert tasks from Pilot 1 to Pilot 2, this may impact other, separate activities that still need to be conducted.Thus, by reducing some of the workload associated with data linking, other tasks may be carried out with less cognitive drain.The value of adopting a Human Factors approach to the design of new technology is that it provides a mechanism to explore the potential impact of the new technology.
Such processes enable us to identify how tasks may change and more importantly, identify any new tasks as a result of technology implementation that can be often overlooked.
Thus "adding workload" to another member of the crew may not be a viable solution as there are other, separate, activities that still need to be conducted.The value of this approach is that it provides a mechanism in which the impact of new technology can be explored using task processing techniques (i.e., early Human Factors integration enables us to identify how tasks may change and more importantly, identify any new tasks as a result of technology implementation that can be often overlooked).
It is therefore important to consider the issues associated with the current human-machine interface (e.g., Eldredge et al., 1992) and seek to improve its usability.The majority of CDU keyboards on modern-day aircraft consist of a square, alphabetically arranged keypad layout.However, for many other everyday products, standard typewriter keyboard arrangements prevail (International Air Transport Association, 2015).These are commonly referred to as QWERTY keyboards (Noyes, 1983).The majority of EFBs are small, portable devices (i.e., smartphone, tablet, and laptop), it seems likely that QWERTY keyboards could replace the current square, alphabetically arranged display, especially if EFBs become even further integrated through means of greater connectivity.The key to successful design is to consider how technology can be used to support cooperation between human and machine (Dekker & Woods, 2002).Thus, the question is not about "who" should do "what," but how technology can be used to support the human operator within the flight deck environment.
A connected EFB brings with it the opportunity to completely revolutionize the design of the FMS as we know it.Fitzsimmons

| Limitations and future work
It should be noted that there is variety across different aircraft configurations and information systems.The systems modeled here were largely based on the vast experience of a Boeing commercial pilot, and therefore further research would need to be conducted to investigate any specific differences to other aircraft configurations.
We must also focus our efforts on how new technology, offering greater levels of connectivity, can be appropriately integrated into | 59 (i.e., single pilot), or distributed flight-crew design (i.e., single-pilot receiving ground support from an additional pilot) as has been suggested in the literature (Stanton et al., 2016).This can be best achieved through the adoption of a sociotechnical systems design approach that considers human, social, organizational, and technical factors (e.g., Hollnagel, 2014;Sarter et al., 1997;Wilson, 2014).
What we cannot overlook is the appetite towards greater levels of connectivity within the aerospace domain and the desire to improve operational efficiencies that can bring benefits to manufacturers, airlines, crews, and passengers.The approach presented in this paper offers one way in which Human Factors process charting techniques can be used early on within the design lifecycle to explore how the introduction of new technology may impact the role of pilots in the future.However, more research is required to validate the assumptions made within the models.Prototype systems, within a simulator environment, would enable us to better understand the performance gains and risks associated with greater levels of connectivity within the flight deck.As connected EFBs have not yet to be developed, these early conceptual models provide a foundation in which to discuss the potential implications of connectivity within the context of a flight deck.

| CONCLUSIONS
In conclusion, the research in this paper has sought to explore the effect of conventional interaction with FMS with that of the inclusion of a connected EFB.Both methods of interaction with the FMS (i.e., with and without the EFB) were analyzed using OESDs.In general terms, the connected EFB reduced the manual inputs and process tasks, but for only one of the pilots.There was a slight increase in work for the other pilot.This suggests that the introduction of connected EFBs will lead to a task load reduction for only one of the pilots.All too often, technology is developed and integrated without considering the impact on the end user.By adopting a user-led design process researchers and developers can identify how the technology may impact the operator (e.g., task loading) and the interaction within the system.
Actors involved in system initialization activities.Actor ResponsibilitiesPilot 1 Inputting, checking, and cross-checking data within the FMS Pilot 2Checking and cross-checking data within the FMS Electronic Flight Bag (EFB) 1 and 2 Contains all relevant data relating to route planning activities, including information on the flight plan Control Display Unit (CDU) Enable pilots to interface with the FMS using a mix of soft and hard keys Flight Management System (FMS) Hold all data relating to navigation and performance-the "heart of all automation in the modern commercial aircraft"(Harris, 2016, p.  238) Navigation Display (ND) Present track and heading against a simplified map Global Positioning System (GPS) Provide accurate data relating to location Inertial Reference System (IRS) Sense and compute linear accelerations and angular turning rates.Data are used for navigational computations Checklist (C) Provide guidance on tasks to be completed Dispatcher Generates the flight plan F I G U R E 1 Excerpt from OESD modelling the "present" system of data entry.OESD, Operator Event Sequence Diagram.situations will exist where the flight crew must enter data manually, for example, the plane is outside of satellite/radio range or there is an inflight diversion.The manual task of data entry should therefore not be viewed as a redundant input strategy because human operators remain the last line of defense in detecting possible failures in the system (Dekker, 2014).
Comparison of total number of operations based on pilot role (e.g., Pilot 1 vs. Pilot 2) in "present" and "future" systems.

( 2002 )
recognizes that cockpits require modernization every 20 years, especially if we are to take advantage of new technological advancements.However, there are significant barriers to such modernization, the most important of which are the bounds of industry standards, conventions, and certifications that dictate the design and functionality of the flight deck.There are also then significant financial costs associated with retrofitting older aircraft, training crew, and implementing the new equipment into the operational procedures which are often met with resistance by commercial airline management and flight crew.Finally, there are substantial concerns related to cybersecurity of such systems, as the external datalink may leave the aircraft vulnerable to hacking threats.
the flight deck.Future research needs to focus on the impact of such design change in terms of the broader flight operations (refer to Supporting Information for OESDs connected FMS and EFB, representing potential future ways of working).This would be an important consideration in the advancement towards a single-crew BANKS ET AL.